We would love to hear your feedback
THE NEWSLETTER  |  07.23.25  |  V05N24
  Co-Founder/Content: Doug Fodeman  |  Co-Founder/Creative: David Deutsch  |  Scambaiter: Rob M
 

Approved Advertisement

Using Social Media to Scam YOU!

During the last few weeks we heard lots of reports about the many scam “Prime Deal” advertisements appearing across social media platforms this July (e.g. Fox News reported that researchers found more than 120,000 fake ads.) We’ve also reported some of these fake Prime Deals in recent newsletters and have several more to share today. But fake Prime deals are not the only way that scammers are targeting people using social media. During the last few weeks, we’ve uncovered LOTS of job offer scams on social media services like Facebook and NextDoor, as well as malicious posts designed to appeal to people’s love for dogs! (See this week’s “For Your Safety” column!) We’ve found some surprisingly odd connections between many of them, as well as “poker tells” that SCREAM FRAUD if you understand the context of these posts! Check out what we discovered on social media sites so you can learn their scammy warning signs!

Let’s start this exercise with a rhetorical question… What legitimate company posts a job offer on July 4th?

Answer: NONE! We can guarantee that anyone posting a job on the July 4 holiday in the US is NOT only a scammer but also not from the USA! Say hello to “Lilia Rowe” who claimed to live in an Everett, MA neighborhood, and posted a “remote job opportunity” on July 4 for an “Online Assistant.” However, Lilia Rowe never identified the company she represented and had only joined the neighborhood community on NextDoor.com a few days earlier.

Since early Spring of this year, we’ve noticed a significant jump in the number of malicious Ads, fake jobs and questionable content appearing on lots of social media sites, such as NextDoor.com, Instagram.com and Facebook.com. Lilia Rowe’s post is a perfect example. She said “If you’re ready to start a rewarding remote career, apply now using the link below” followed by a link to the free Google form shown below. Take a look and as yourself if any of the form’s questions strike you as odd. And is anything missing from this form?

    Of course we found many “red flags” that scream FRAUD to us! Such as….

    1. What company does she represent? Where is the company name? She never tells us!
    2. She asks “Are you interested in this remote job?” and provides a YES/NO response. This is absurd because if you weren’t interested, why bother completing anything in the form! 
    3. The application form for this job has a statement (not a question) saying “I hope you are 20 years and above?” NO legitimate recruiter would write this, and then ask you to respond YES or NO.
    4. She asks for your WhatsApp number, saying that training will happen via WhatsApp. This is 100% a GUARANTEE that this is a scam job and not real!
    5. Lilia Rowe says that she will forward all of your submitted details to the “Admin department” but never mentions the NAME of her company! Again.

    And then on July 5, a man from Everett, Massachusetts named Miguel Sandoval posted another job opportunity. He was looking for someone “to help with data entry work.” His post included a link to another free Google form. This form, for a Data Entry Assistant, had many similar red flags to Lilia Rowe’s form, such asking if you were interested (YES/NO) and asking for your WhatsApp number to conduct the interview. However, most interestingly was the fact that Miguel Sandoval’s post included a banner with a company name as “Beel Career Recruitment Agency.” This is where our investigation ran down a rabbit hole into Crazyland!

    When we conducted a Google search for “Beel Career Recruitment Agency” we literally found only one link to a Facebook page called linawilson120. (NOTE: A few hours after our investigation on July 17, the photo shown below of “Lina Wilson” disappeared completely from this Facebook account and was replaced by a logo showing only the name “Lina Wilson.”) On July 17, Lina Wilson had only 6 likes and 6 followers, but none of their details were visible to the public. Notice in the screenshot below that her Basic information says that her account represents an “Employment Agency” and provides another link to a job application form on Google. She had multiple posts for job openings, including a post made 7 minutes before we found her Facebook account. We conducted a reverse image search for the photo we found in Lina Wilson’s account and the results SAID EVERYTHING YOU NEED TO KNOW about this so-called recruitment agency! The profile photo was associated with lots of social media accounts using different names. This included a very sketchy Pinterest account from India filled with photos of Lina Wilson, and other women. Many of these photos are rather “revealing” though not pornographic. (NOTE: the Pinterest link begins with “in.pinterest.” Google’s AI says that this Pinterest link design indicates it refers to a Pinterest account located in India. Our experience with the domain name system agrees with this conclusion.)

    There are sooooo many red flag warning signs related to some of these job posts! For example, the above post from Miguel Sandoval, connected to the Google form labelled “Beel Career Recruitment Agency” and leading us to Lina Wilson’s Facebook page contained additional red flag warnings…

    • Lina Wilson’s “About” page on her Facebook account showed her phone number as 814-388-1009. A Google search for this number also turns up a link to a strange website registered in Russia called snowmtl[.]ru that VirusTotal tells us is malicious! And then, several hours later on July 17, this phone number disappeared from her Facebook account!
    • Lina Wilson’s “About” page on Facebook shows an impossibly written business address for the Beel Career Recruitment Agency. It is “332 C St SW, Ephrata, WA 98823, Washington D.C., DC, United States, 98823.” This address cannot be in both Washington State AND Washington D.C. This mistake, along with adding “United States” to the address, strongly suggests that these scammers are NOT from the US!

    NOTE: We also found another social-media related to Lina Wilson, but using another woman’s photo. It can be found at: https://www.threads.com/@lina_wils0n (Both accounts use a zero in place of an o in wilson.)

    Speaking of Washington, DC, Scambaiter Rob found this next job post on July 6 from Justin Campbell who claims to be from Washington, DC. Rob added a list of suspicious facts following Justin’s post, all of which were spot on! (See the screenshot below.) It turns out that Justin Campbell had just joined the NextDoor community on July 1st and then began posting in several Tribeca, New York communities that he was looking for a “Personal Assistant/data entry” person to hire. Just like the above bogus job posts, Justin Campbell provided a link to a free Google form. But this time, his unprofessional and incompetent use of the Google form was crystal clear…

    1. He duplicated and posted the first question twice.( We removed the 2nd post to save space.)
    2. He posted an incomplete question in the form shown simply as “Option 1.”
    3. Again, he asks for your WhatsApp number, and adding at the bottom of the form “our HR will contact you asap” but NEVER mentions the company’s name!

      On July 13 we were contacted by a very savvy woman (named Nancy) who saw another job post on the “Coastal Peabody” community in NextDoor made by a woman named Melissa Sherman. Nancy, who has given us permission to use her first name, posted several red flag warnings about this job opportunity! By now, these should all be CRYSTAL CLEAR to our readers!

      With this recent explosion of job fraud appearing on NextDoor.com and other social media sites, we decided to use Google to evaluate how much fraud could possibly be happening. Using the “site” command and quotes for exact word searches, we asked Google what it might find when searching for Google’s forms (forms.gle) and “data entry” specifically on NextDoor.com. Google found many DOZENS of listings, including many that are oddly posted on “for sale & free” pages or on “ask neighbors” pages. Seriously? Why post a job for a data entry position as a comment underneath someone’s used Microwave for sale in Wichita, Kansas? BECAUSE IT’S A SCAMMER’S POST! 

      One of these bogus job posts for an “Online Data Entry Clerk” led us to a NextDoor post by Jace Cruz, from Rice Lake, Wisconsin. It was made on June 30. We couldn’t help but notice that Jace Cruz was wearing a beautiful, bright blue shirt in his photo! We conducted a reverse image search of this photo and discovered that it could be found on DOZENS of posts from all around the world, especially on Facebook accounts! Many of these pages seemed to be dating pages on Facebook. Countries included Uganda, Zimbabwe, “USA Dating Site” and others. This photo of Jace was also found to have lots of other names, like Leroy Robinson.  And did we mention that Jace Cruz’s NextDoor account was started 8 days before he posted his job opening, and without naming the company that his job post is for?

      We want our readers to understand the depth and scale of this fraud. Our investigation was just a drop in the bucket of how deeply we could have explored this dark rabbit hole. Here is one more important point about the scale of this fraud that is misusing social media services to target people… We conducted another specific search of the social media site NextDoor, for Google forms and the word “remote.” What Google found also demonstrates that this fraud is targeting citizens across the USA AND Canada! Some of these scammers are so incompetent if you pay attention to details! When we followed another link to an online Google form about a remote data entry job, we found English errors and references to a company with NO NAME. The form also included a request for your “Whatsaapp” number. Proper English and spelling matters! We have more types of social media fraud to share with you later in this week’s newsletter. Keep reading!

      Approved Advertisement

      Post Prime Day Poop, Our Mistake, Rob’s New Girlfriend, & More!

      Last week we showed readers some examples of very malicious emails disguised as “Prime Day Deals.” Quite remarkably, we saw this type of fraud continue through all four Prime Deal days and beyond! Though these deals have expired, we want to make sure you are aware of them because they’ll pop up again as “Christmas deals” this winter as we approach the holidays. Check out this email from “Deal Watchdogs – Prime Day Deals.” But the email actually came from a very strange domain named Rokhfirooz[.]com. This domain was registered waaay back in 2015 but has no web page at the top of the domain. The links point back to this website and it has been identified as a phishing scam by VirusTotal!

      The Daily Scam has been publishing articles and information about online fraud for 14 years as of this August. During that time, we have made only two errors that needed to be corrected, many years ago. Very recently, we made our third mistake that almost caused a man’s computer to suffer a malware infection! We are terribly sorry and immediately corrected the issue after he informed us! On July 8, the gentleman said “Hi Guys, Whilst re-reading your article about the SPCA scam I clicked the first link to Sucuri.net, which appears in the line, ‘We used Securi[.]net to reveal that this link will, in fact, redirect you”  It points to Securi[.]net but instead this appeared:” (NOTICE our spelling error in his paragraph.)

       

      It turned out that we misspelled the security tool website Sucuri.net as Securi[.]net! It turned out that cybercriminals had purchased that misspelled domain and created traps on it for those who make this spelling mistake! Fortunately, the man’s Apple computer suffered no breach and he didn’t fall for their tricks at the misspelled site. We quickly made the correction. But this also demonstrates what sleazy opportunists scammers can be! As we’ve said many times, spelling matters and our mistake is a perfect example of that! We used to say to our readers “Never Goggle[.]com!” That’s because Goggle[.]com was also a malicious website! In October, 2022, the REAL Google acquired the goggle[.]com domain, along with goggle[.]net and goggle[.]org, in order to protect their brand and the public. But we still think it is wise to exercise caution regarding misspelled domains and will do better ourselves!

      Once again, we wish to report that Professional Scambaiter Rob continues to piss off scammers AND that he has a new “benign” girlfriend! (Whatever that means.) He recently shared these two emails with us. We think they’ll put a smile on your face, especially if you can figure out what the heck his new girlfriend is trying to say to him! Also, he’s not blond but he’s considering dying his hair before meeting his new girlfirend! As for the pissed-off scammer, we think he lives in a country where canines are not highly regarded. Perhaps Nigeria? Or an Islamic country like Iran?

      One of our readers shared this article from Chase Bank about social media scams and how to spot them. It’s a good article! https://www.chase.com/digital/resources/privacy-security/security/social-media-scams

      A woman received a call from her Navy Federal Bank to say that there was fraudulent activity in her bank account. If this ever happens to you, HANG UP! Then call your bank using the phone number on your card or found on the bank website. This woman did not and gave the scammers $2500! Check out this post about it on Reddit: https://www.reddit.com/r/Scams/comments/1lxncjm/us_scammed_through_bank_account/

      According to this recent report on Axios.com, cybercriminals are using AI to design and build phishing pages in seconds. No surprise. What is shocking is that the creators of these AI tools didn’t anticipate this and put protective guardrails into their tools to protect the public.  Check out: https://www.axios.com/2025/07/01/okta-phishing-sites-generative-ai

      The FBI is reporting that scammers are pretending to be Health Insurance companies to collect personal information on victims, and perhaps their bank account details too. Check out this article about it on Hackread: https://hackread.com/fbi-warns-health-insurance-scam-steal-medical-data/

      Would you believe that between 2019 and now, more than 230 people in New Hampshire alone have lost millions of dollars by scammers stealing their properties! Crazy fraud! Check out this article about this property scam: https://www.yahoo.com/news/hundreds-people-hampshire-had-property-183100613.html

      Last week, another Reddit member posted that he had received an unexpected $2500 via Apple Pay from an unknown person. That unknown person was pressuring him to return the money. And yes, this was a scam! Check out the post, and more importantly, the responses! https://www.reddit.com/r/Scams/comments/1m0ku7d/new_york_apple_cash_scam/

      Watch this 4 minute video about fake AI-generated scam videos and then please share it with your friends and family!  https://www.youtube.com/watch?v=FERa1AI2EK8

      Password Authentication Reminder & Apple Approval Notice

      In our first smelly phish the recipient was told that he needed to verify his account. He was instructed to log into his Accounting business account and update his password before it expired. Of course, his account doesn’t force password updates and he knew this was a fraud! Also, the email came from a server in Japan. (Notice “.jp” at the end of the email address.) His business is in the US. The link connected to “Keep Password” points to a weird domain named surfisklenz[.]com and NOT to the man’s business domain. The phishing page included the man’s email in it because it was buried in that long crazy link to surfisklenz].]com. We used a tool to visit the source of that link and found that this phishing page had also been disguised as a Gmail login! Look at the bottom of the login screenshot.

      One of our readers received this Apple Approval Notice for a supposed $500 purchase! This notice was very clever because it was actually sent from a bogus iCloud account, contains an Apple logo, AND the link pointing to Apple billing support is correct!. But in red, it says that this purchase looks suspicious and asks the recipient to “Call us” +1 (803) 871-3960” to speak to an Apple Representative. This action is, of course, the critical part of this fraud because 803-871-3960 is NOT Apple’s phone number! It’s a scammer’s phone number! Remember to report your smelly phish to us and Google!

      https://safebrowsing.google.com/safebrowsing/report_phish/

      Home Security Free Installation

      Cybercrminals are notorious for stealing the content of legitimate businesses and re-wrapping that content with malicious links and bogus domains. This email, disguised to look like an offer from Brinks Home Protection Team, is a perfect example! The email actually came from a free Gmail account named veinbarry657 and not any domain remotely looking like, or belonging to Brinks. According to Google’s AI, “the phone number 888-280-7039 has been associated with Amazon customer service. However, reports on social media platforms like Facebook indicate that this number has been used in scam attempts, with callers claiming Amazon accounts have been hacked.” And most telling of all, is that the links in this rotten email all point to a website in Italy called LaNostraVacanza[.]com, meaning “our holiday.” If you truly want to enjoy your holiday, just don’t click this link!

      This is Only for REAL Dog Lovers!

      During the last few months, we’ve seen several different instances of scammers using people’s love for dogs to target them on social media platforms. (The Top Story of our June 4 newsletter was also about dog stories as tricks to scam people.) Recently, we found this again on the community website, NextDoor.com. On June 13, a man named Tristan Blackmoor posted a photo of a German Shepard and asked people “if you can name more than 13 of these dog breeds…” This was followed by a link to a website at the domain dailyall[.]site. For the record, though none of our security tools identified this website as malicious, we believe it is malicious because of the oddball domain name and the fact that it was recently registered about 7 and ½ months earlier. Also, Tristan Blackmoor joined NextDoor less than two weeks earlier and this website lists their business address as a location that doesn’t exist, according to Google. It is: 24 M Drive East Hampton, NY 11937.  We also discovered that Tristan posted several other links and photos on NextDoor pretending to be Prime Day deals! Check out the screenshots below. Also, for the record, that photo of the German Shepard with the sign saying “I am 11 years old” is all over many Facebook accounts, such as this Facebook page.

      Be Cautious with Political Texts! And a Text from Amazon Customer Support!

      In our highly polarized, political society today, we believe that cybercriminals are likely to be using politics to target Americans. For example, we recently received a politically-charged text containing a link that, we believe, is HIGHLY SUSPICIOUS. To be clear, we do not have proof that this link is malicious but please look at our reasoning below and the text that follows. The text asked “Do you think Donald Trump should win the Nobel Peace Prize?” To answer yes or no, we are asked to click a link to a domain named demswhowin-gift[.]com. Here are our concerns….

      1.  Demswhowin-gift[.]com was registered in Iceland on March 4, about 4 and ½ months earlier. The chosen Registrar for this domain is Namecheap. Namecheap is notorious for being heavily used by cybercriminals.
      2. The text was sent from a phone number that is completely unknown to Google: 877-294-8945. (This text did not come from a registered short code, but many politically-related texts don’t seem to use registered Short Codes either.)
      3. The domain demswhowin-gift[.]com is being hosted on a server in Germany on the date we checked it in July.
      4. There is a Political Action Committee called “Democrats Who Win.” This PAC is listed on ActBlue, though the “Democrats Who Win” PAC on ActBlue does not show any registered domain for this PAC. However, we did find two domains that were registered in the US on the same day with the same Registrar on October 10, 2023. Both of these domains are hosted on servers in the United States and appear to be legitimate: demswhowin.org  and democratswhowin.org. 
      5. Unlike these two DOT-org domains that we believe are legitimate, we also found another domain called demswhowin[.]com. It was also registered through Namecheap on September 10, 2024 and is also hosted on a server in Germany, similar to demswhowin-gift[.]com. It is equally suspicious to us.

      Bottom line…. While we cannot prove the domain in this link is malicious, we have our suspicions. Please be careful of unsoliticited, unfamiliar texts that you receive and never assume they are legitimate without checking them out BEFORE YOU CLICK!

      This next text is 100% malicious and did NOT come from Amazon! It clearly uses behavioral engineering to trick you into clicking a link to get a supposed refund. But the link points to a link-shortening service of X (formerly Twitter). When we unshoreted that link we discovered that you’ll be forwarded to a domain called We57233[.]com. It’s very clear what VirusTotal’s security services thinks about this domain!

      A newsletter without job scam texts is like a week without sunshine! Enjoy…

      Until next week, surf safely!

      Copyright © 2025 The Daily Scam. All rights reserved. You are receiving this email because you have subscribed to thedailyscam.com

      Marblehead, MA 01945

      Contact Webmaster